Week of April 20, 2026

A vulnerability in Microsoft Entra ID allowed an attacker to escalate privileges and potentially take over a tenant by abusing Service Principals. The flaw has been fully patched by Microsoft.

A vulnerability in the Linux kernel, tracked as CVE-2026-31431, allows an unprivileged local user to escalate privileges to root. The flaw is easily exploitable and affects a wide range of Linux systems. It poses a significant risk to endpoint security by enabling attackers to gain full control over affected machines.

Anthropic's restricted AI model, Claude Mythos Preview, identified more than 10,000 high- or critical-severity vulnerabilities across critical open-source software in under two months. This demonstrates a significant advancement in AI-assisted offensive security research, potentially accelerating vulnerability discovery at an unprecedented scale.

A proof-of-concept tool demonstrates bypassing Unisoc UMS512 (T618) firmware signature verification by patching the Secondary Program Loader (SPL) to disable RSA signature checks. The BootROM only verifies the SPL's SHA256 hash, allowing a modified SPL to be flashed, which then skips verification of subsequent boot stages. This enables persistent unsigned code execution on the device.

Trigona ransomware affiliates have been observed using a custom data exfiltration tool to streamline theft before encryption. The tool is designed to efficiently collect and transfer sensitive data from compromised endpoints, reducing reliance on generic utilities. This represents a notable shift in pre-ransomware tactics, as custom malware for exfiltration is uncommon.

Expel tracks a North Korean APT subgroup, HexagonalRodent, that targets Web3 developers with fake job offers and malicious coding assessments to steal cryptocurrency. The group uses generative AI tools like Cursor and ChatGPT to craft attacks and has exfiltrated up to $12M in crypto wallets over three months. Their malware includes BeaverTail, OtterCookie, and InvisibleFerret, delivered via booby-trapped VSCode tasks or backdoored code.

An exposed server revealed a large-scale, AI-assisted exploitation operation named Bissa Scanner, which leveraged CVE-2025-55182 (React2Shell) to compromise over 900 victims and harvest credentials from tens of thousands of .env files. The operator used Claude Code and OpenClaw for workflow orchestration, targeting financial, cryptocurrency, and retail sectors for deeper post-compromise collection. The operation demonstrates a mature, modular pipeline for scanning, exploitation, credential validation, and alerting via Telegram bots.

CrowdStrike disclosed a critical unauthenticated path-traversal vulnerability (CVE-2026-40050) in its LogScale platform. A remote attacker can exploit the flaw to read arbitrary files from the server's filesystem without authentication. The vendor issued an urgent security advisory.

Beatrice.py is a Python tool that modifies machine code in x64 binaries by substituting assembly instructions with functionally equivalent alternative opcodes of the same size. It aims to evade signature-based detection such as YARA rules and some antivirus solutions without altering program behavior. The tool was tested against Windows Defender and Elastic YARA rules in April 2026, showing mixed but often successful evasion for various C2 payloads and tools like Mimikatz.

An attacker compromised a Vercel employee's Google Workspace account through an OAuth token stolen from Context.ai, which was initially breached via Lumma Stealer malware disguised as Roblox cheats. The attacker then accessed Vercel internal environments and customer credentials. Vercel notified affected customers and published indicators of compromise.

Researchers used LLM-driven agents to automatically discover security vulnerabilities, including remote out-of-bounds writes in the Linux kernel and flaws in Docker and OpenSSL. This demonstrates a new automated approach to vulnerability research that could accelerate both defensive patching and offensive exploit development.

An affiliate of The Gentlemen RaaS deployed SystemBC proxy malware during an incident response engagement. The Gentlemen RaaS provides multi-OS lockers and EDR-killing tools, and has claimed over 320 victims, mostly in 2026. SystemBC established covert SOCKS5 tunnels and was found on over 1,570 victims, primarily organizations.

A zero-click authentication coercion vulnerability in Windows Shell, tracked as CVE-2026-32202, stems from an incomplete patch for a previous security feature bypass. The vulnerability is actively exploited by Russian APT28 to bypass Defender SmartScreen, enabling malware delivery without user interaction.

CVE-2025-27937 is a path traversal vulnerability in Tenable Quick Agent V2 and V3. An authenticated remote attacker can exploit it to read arbitrary files on the affected system. The vulnerability has a CVSS v4 base score of 7.1 (High).